Response | Policy cont’d

• Enable audits

  • Turn on system accounting (event logging)... configure for maximum granularity
    • Log files will be large, but disk space is cheap
    • Detailed log files hard to review, but tools help
  • Good hack tools exist for deleting or modifying log files, so
    • Protect their access
    • If possible, log to a different system, not connected via LAN/WAN... use a serial connection to standalone system with minimal O/S for example
  • Manage audit trails (system logs) to preserve an unbroken chain of evidence that can be used to prosecute criminal behavior
  • Employers’ written policies
    • Signed ‘fair use’ agreements recommended
    • Valid even if employees don’t sign so long as the employees know they exist